Providers

API Reference

Zones

Providers

List providers

client.Zones.Providers.List(ctx, zoneID, query) (*ZoneProviderListResponse, error)

GET/zones/{zoneId}/providers

Create provider

client.Zones.Providers.New(ctx, zoneID, body) (*Provider, error)

POST/zones/{zoneId}/providers

Get provider

client.Zones.Providers.Get(ctx, id, query) (*Provider, error)

GET/zones/{zoneId}/providers/{id}

Update provider

client.Zones.Providers.Update(ctx, id, params) (*Provider, error)

PATCH/zones/{zoneId}/providers/{id}

Delete provider

client.Zones.Providers.Delete(ctx, id, body) error

DELETE/zones/{zoneId}/providers/{id}

Validate provider connection

client.Zones.Providers.Validate(ctx, id, body) (*ValidationResult, error)

POST/zones/{zoneId}/providers/{id}/validate

ModelsExpand Collapse

type Provider struct{…}

A Provider is a system that supplies access to Resources and allows actors (Users or Applications) to authenticate.

ID string

Unique identifier of the provider

CreatedAt Time

Entity creation timestamp

formatdate-time

Identifier string

User specified identifier, unique within the zone

minLength1

maxLength2048

Name string

Human-readable name

minLength1

maxLength255

OrganizationID string

Organization that owns this provider

OwnerType ProviderOwnerType

Who owns this provider. Platform-owned providers cannot be modified via API.

Accepts one of the following:

const ProviderOwnerTypePlatform ProviderOwnerType = "platform"

const ProviderOwnerTypeCustomer ProviderOwnerType = "customer"

Slug string

URL-safe identifier, unique within the zone

minLength1

maxLength63

UpdatedAt Time

Entity update timestamp

formatdate-time

ZoneID string

Zone this provider belongs to

ClientID stringoptional

OAuth 2.0 client identifier

ClientSecretSet booloptional

Indicates whether a client secret is configured

Description stringoptional

Human-readable description

maxLength2048

Metadata ProviderMetadataoptional

Provider metadata

IconURL stringoptional

Icon URL

formaturi

maxLength2048

Protocols ProviderProtocolsoptional

Protocol-specific configuration

Oauth2 ProviderProtocolsOauth2optional

OAuth 2.0 protocol configuration

Issuer string

OIDC issuer URL used for discovery and token validation.

formaturi

AuthorizationEndpoint stringoptional

formaturi

AuthorizationParameters map[string, string]optional

Custom query parameters appended to authorization redirect URLs. Use for non-standard providers (e.g. Google prompt=consent, access_type=offline).

AuthorizationResourceEnabled booloptional

Whether to include the resource parameter in authorization requests.

AuthorizationResourceParameter stringoptional

The resource parameter value to include in authorization requests. Defaults to "resource" when authorization_resource_enabled is true.

CodeChallengeMethodsSupported []stringoptional

JwksUri stringoptional

formaturi

RegistrationEndpoint stringoptional

formaturi

ScopeParameter stringoptional

The query parameter name for scopes in authorization requests. Defaults to "scope". Slack v2 uses "user_scope".

ScopeSeparator stringoptional

The separator character for scope values. Defaults to " " (space). Slack v2 uses ",".

ScopesSupported []stringoptional

TokenEndpoint stringoptional

formaturi

TokenResponseAccessTokenPointer stringoptional

Dot-separated path to the access token in the token response body. Defaults to "access_token". Slack v2 uses "authed_user.access_token".

Openid ProviderProtocolsOpenidoptional

OpenID Connect protocol configuration

ExternalIDClaim stringoptional

Name of the OIDC claim carrying the stable external id used to correlate logins with externally provisioned (SCIM) users. Defaults to "sub". Set to "oid" for Entra, whose pairwise "sub" differs from the SCIM externalId.

Scopes []stringoptional

Additional OIDC scopes to request from this provider during authentication (e.g. "groups"). Merged with the default scopes (openid, profile, email).

SingleLogoutEnabled booloptional

When true, logging out of the zone propagates the logout to this provider's end_session_endpoint (RP-initiated logout). Defaults to false.

UserIdentifierClaim stringoptional

Name of a top-level string claim in this provider's ID Token to use as the user identifier on user creation. When not set, the user's Keycard ID is used.

UserinfoEndpoint stringoptional

formaturi

Type ProviderTypeoptional

Accepts one of the following:

const ProviderTypeExternal ProviderType = "external"

const ProviderTypeKeycardVault ProviderType = "keycard-vault"

const ProviderTypeKeycardSts ProviderType = "keycard-sts"

type ValidationResult struct{…}

Result of running the provider OIDC connection checks on demand. Not persisted.

Checks []ValidationResultCheck

Per-check results, in execution order

Check string

Identifier of an individual provider validation check

Accepts one of the following:

const ValidationResultCheckCheckIssuerReachability ValidationResultCheckCheck = "issuer_reachability"

const ValidationResultCheckCheckMetadataRetrieval ValidationResultCheckCheck = "metadata_retrieval"

const ValidationResultCheckCheckEndpointConsistency ValidationResultCheckCheck = "endpoint_consistency"

const ValidationResultCheckCheckAuthorizationEndpointReachability ValidationResultCheckCheck = "authorization_endpoint_reachability"

const ValidationResultCheckCheckCredentialExchange ValidationResultCheckCheck = "credential_exchange"

Status string

Outcome of a single check. pass/fail mean the check ran. skipped_with_reason means it could not run because a prerequisite is missing on our side (e.g. no credential stored). not_applicable means the check does not apply to this provider class (e.g. a login-flow-only provider that does not advertise the client_credentials grant) — render as a neutral state, distinct from a failure. Neither skipped_with_reason nor not_applicable fails the overall run.

Accepts one of the following:

const ValidationResultCheckStatusPass ValidationResultCheckStatus = "pass"

const ValidationResultCheckStatusFail ValidationResultCheckStatus = "fail"

const ValidationResultCheckStatusSkippedWithReason ValidationResultCheckStatus = "skipped_with_reason"

const ValidationResultCheckStatusNotApplicable ValidationResultCheckStatus = "not_applicable"

Detail stringoptional

Human-readable explanation, present on fail, skipped_with_reason, and not_applicable.

ProviderID string

Provider that was validated

Status ValidationResultStatus

Overall outcome. fail when any individual check failed; skipped checks do not fail the run.

Accepts one of the following:

const ValidationResultStatusPass ValidationResultStatus = "pass"

const ValidationResultStatusFail ValidationResultStatus = "fail"

ValidatedAt Time

When the validation run completed

formatdate-time